News for hackers. Stuff that matters.
Re:Anatomy of a JWT by senko on Tuesday March 01, 2022 @09:40AM (#30514667)
That's reasonable.

I see so many cases where someone asks "what should I use for auth" and immediately the answer given is JWT, where simple random tokens or session auth would be just fine. And simpler to implement, since they're supported out-of-the box in many frameworks.

Re:Anatomy of a JWT by robotdan on Tuesday March 01, 2022 @10:32AM (#30515351)
This is a good point. Keeping it simple is always a good engineering choice.

I think one of the reasons JWTs come up so often is that if you are going to use OAuth2/OpenID Connect - ideally the Authorization Code grant, then tokens become an important component.

And many IdPs implement the OAuth2 access token as a JWT. So it may be that your IdP ends up making this choice for you. Then you have to learn how to deal with JWTs.